39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112

Analysis

max time kernel
134s
max time network
179s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 20:27

Target

39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe
Size

24KB
MD5

812c2e6ddb575fb9789df6e76ad37e00
SHA1

deeae1d955843403a7e62a026d7ea4cfb75c985f
SHA256

39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112
SHA512

15769b6061cf01ae8d657058a92f44d07f29d63bb007497310eebb05c88fef32bcd1644cb1ed9440e817ff89c0b96d065869ebffdf511cd0348f759d744330fb
SSDEEP

384:qcewIgf3Yf/GKx9s8jrQpG3dXE2yBQ3tivK8HeYWiZzdJ26zuIqMW6knARw0np:rew4fum9v40AnKzqxK6fqMWxi

Score

7^/10

Deletes itself 1 IoCs

pid	Process
988	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1296	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe
1296	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 908 wrote to memory of 1296	908	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	27
PID 1296 wrote to memory of 988	1296	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	28
PID 1296 wrote to memory of 988	1296	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	28
PID 1296 wrote to memory of 988	1296	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	28
PID 1296 wrote to memory of 988	1296	39f483d6830be19ce1b3f49427b52f8f24b5fc630e9bdcc135b3c75510364112.exe	28

memory/908-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/988-57-0x0000000000000000-mapping.dmp

Download
memory/988-59-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/988-60-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1296-55-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1296-56-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download